Modern enterprises are increasingly adopting APIs, exceeding all predictions. With more businesses investing in microservices and the increased consumption of cloud APIs, you need to secure beyond just a handful of well-known APIs. You will need to secure a higher number of internal and external endpoints. Security itself is a broad area and authentication and authorization is a key element in API security. Vendors implement a number of seemingly similar standards and patterns, making it very difficult for consumers to settle on the best option for securing APIs. The sheer number of options can be very confusing. At the same time, technology stack and industry practices are under a rapid transformation, browsers are enforcing different restrictions, new privacy regulations are in place, and more. That makes the authentication and authorization best practices you relied on a few years ago obsolete now. These slides we will discuss: - What is new and what is old in OAuth 2.0 - Mitigate security exploits by understanding the OAuth 2.0 threat landscape - Pick security standards and protocols to match business needs - Federated identities to expand business APIs beyond the corporate firewall - User strong authentication and authorization for API access - Adaptive and risk-based access control for API

1. Authentication and Authorization Best
Practices for Your API in 2021
June 16, 2021
isharak@wso2.com
Director of Engineering, IAM @ WSO2
Ishara Karunarathna

2. 2
The Agenda
● High-level API security architecture
● Authentication and authorization for API access
● Implementing authentication and authorization best practices
○ Demo using WSO2 Identity Server

3. API Security Architecture

4. 25,000-Foot View of API Security Architecture
4

5. Closer View of API Security Architecture
5

6. Recommended OAuth 2.0 Flows for API Access
6
Grant Type Web App Native App SPA Services Device
Authorization Code X
Authorization Code with PKCE X X
Client Credentials X X
Implicit Flow X*
Password Grant X*
Device Authorization Grant X
JWT and SAML Grant (RFC7523) X
OAuth MTLS (RFC8705) X X
Token Exchange (RFC8693) X X

7. Authentication and Authorization for API
Access

8. 8
Over
8.4B
records exposed during the
first quarter of 2020
Whopping
273%
increase compared to Q1
2019
Approximately
70%
due to unauthorized access to
systems or services
Due to the COVID-19 pandemic, millions of employees around the world
switched to remote working, and many businesses were forced to adopt
digitalization within a short time frame. Attackers thrived during this period
because companies skipped some of the long-held security practices in the
rush to adopt the new normal.
2020
2020 Q1 Data Breach QuickView Report - Risk Based Security

9. 9
IAM should not be the weakest link in the system

10. End-User Identity Management
Digital identities can be everywhere. Managing them is a primary concern.
● Different user Stores
● Different user types
● Different user schemas
● Different user management workflows
10

11. 11
Authentication
Verifying that a person is who they
say they are.

12. Authentication
‘Passwords’ are Not Secure!
● Around 60% of people reuse passwords across multiple sites regularly.
● 13% of people use the same password for all accounts and devices.
● 48% of workers use the same password in both their personal and work
accounts.
● 80% of data breaches in 2019 were caused by password compromise.
Authentication must be a focal point when protecting your APIs.
12

13. Strong Authentication
Authenticating users by challenging them with multiple authentication factors, e.g.,
password, SMS, and fingerprint.
● Multi-factor authentication (MFA)
⦿ Knowledge
⦾ Something you know
⦾ Password, pin, secret
⦿ Possession
⦾ Something you have
⦾ Phone, token, badge, smart card
⦿ Inherence
⦾ Something you are
⦾ Fingerprint, facial feature, voice

14. 14
User is not static, so is their authentication
● Authentication needs to be more
dynamic and responsive
● Context sensitivity is important
● Security is key, but it should be
balanced with convenience

15. Adaptive Authentication
● Provides high security without impacting usability.
● Select the right authentication factors depending on a user’s risk profile and
tendencies.
15

16. Demo time

17. Federated API Access
17
Attract developer community Acquisitions and mergers Hassle-free API access

18. Federated API Access
18

19. Identity Federation
19

20. Demo time

21. 21
Authorization
Verifying whether the user is
permitted to access a specific
resource or function.

22. Authorization
● OAuth 2.0 scopes limit an application's access to a user's resources.
● Authorization server-level and resource-level scope validation.
Upcoming,
● Rich Authorization Requests (draft)
● Incremental Authorization (draft)
22

23. Fine-grained Scope Validation
Rule and Policy-Based scope validation:
● XACML
● Open Policy Agent (OPA)
23

24. Question Time!
24

25. wso2.com
Thanks!